In this section we go a step further and switch from a passive to an active attacker scenario.
Instead of simply sniffing the IR channel, our objective was to destroy infrared frames ``in the air'', such that the
legitimate receiver will not be able to receive a valid command any more. This is also referred to as \emph{Jamming}.\\
Beside the quite unsophisticated destruction of all frames, we also took so called \emph{Reactive Jamming} into consideration which will
be discussed in Section \ref{sec:reacjam}.\\

\subsection{Sending}
Furthermore, we attached importance to the possibility of running injection attacks, which leads to the prerequisite of being able to send arbitrary IR frames of any
protocol.\\
As described in Section \ref{sec:protocols}, the information is pulse-width modulated on a carrier signal of e.g. 38kHz for the NEC
protocol. To put it simply, an IR frame consists of alternating idle and light phases, where the diode is emitting infrared light.
The binary zero and one just differ in the length of these phases, but again the timings are also depending on the protocol.
For the NEC protocol, a 0-bit is comprised of a $\sim$560$\mu$s pulse and a pause of equal length, whereas a 1-bit consists of a $\sim$560$\mu$s and a $\sim$1690$\mu$s
idle phase \cite{IRMP}.\\
In order to send out valid IR frames, we made use of an already present library written by Ken Shirriff \cite{irremote}.\\


\begin{lstlisting}[caption=Function from the IRremote library to send an NEC frame., captionpos=b, language=c++]
 void IRsend::sendNEC(unsigned long data, int nbits)
{
    enableIROut(38);
    mark(NEC_HDR_MARK);
    space(NEC_HDR_SPACE);
    for (int i = 0; i < nbits; i++) {
        if (data & TOPBIT) {
            mark(NEC_BIT_MARK);
            space(NEC_ONE_SPACE);
        } 
        else {
            mark(NEC_BIT_MARK);
            space(NEC_ZERO_SPACE);
        }
        data <<= 1;
    }
    mark(NEC_BIT_MARK);
    space(0);
}
\end{lstlisting}
The \texttt{mark()} and \texttt{space()} functions are basically just wrappers for turning the IR diode on and off. Thus, one can
see that depending of a zero or an one data bit, the light is emitted for a certain period or not. These periods, as already mentioned, are very
protocol specific.\\
Furthermore, one has to be aware of that data which is passed to the function, must have exactly the form as the IR frame on the medium.
This means, at least for most of the protocols, that the bit order of the command, the address and the inverted parts have to be brought into least
significant bit first ordering.

\subsection{Simple Jamming}
For the simple jamming part, we basically just had to inject a small peace of code inside of the interrupt service routine (ISR).
The ISR is called every 65$\mu$s in order to check whether an IR transmission has started. So all one has to do, is to go to the point where
the start bit of an IR frame is detected and start emitting light, for instance by sending out any IR frame, to cause interference.
In our case, we just sent a usual length NEC frame consisting of only binary ones.
\begin{lstlisting}
 irsend.sendNEC(0xFFFFFFFF, 32);
\end{lstlisting}
During our experiments, the distance from the receiver to the jammer was always the same as the distance to the legitimate sender.
The location and the distance of the jammer strongly depend on its ability to send out light with a higher intensity than the actual sender.

\subsection{Reactive Jamming}\label{sec:reacjam}
Most usual, the goal is not to destroy every transmission but only a selected subset. For a simple IR communication with a remote control,
one could for example only jam particular commands that come from a device with a certain address.
In order to realise this, we implemented a kind of filter inside of our reception routine that queries the data after each newly received bit and
checks whether the applied filter matches.

\begin{lstlisting}[caption=Function to decide whether the command and address filter matches the so far received data, captionpos=b, language=c++, basicstyle=\small]
uint8_t decide_NEC_Jam(uint32_t data) {

    if (++data_bit_counter == 32) {
        data_bit_counter = 0;
        return ((data & 0xFF) == filter_command);
    }
    
    if (data_bit_counter<16 && filter_address==0 && 
        filter_command==0) {
      return 1;
    }
        
    if(data_bit_counter == 16 && filter_address != 0) {
        return = (data == filter_address);
    }
    
    if(data_bit_counter == 24 && filter_command !=0 ) {
        return = ((data & 0xFF) == filter_command);
    }
    return 0;
}
 
\end{lstlisting}


\begin{lstlisting}[caption=Application of the command and address filter inside the reception routine, captionpos=b, language=c++, basicstyle=\small]
if(MATCH_SPACE(irparams.timer, NEC_ZERO_SPACE)) {
  nec_data <<= 1;
  if (decide_NEC_Jam(nec_data)) {
      irsend.sendNEC(0xFFFFFFFF, 32);
      Serial.println("JAMMMMMMM");
      nec_data = 0;
      data_bit_counter = 0;
      irJam.start();
      return;  
  }
  irparams.rawbuf[offset++] = NEC_STATE_ACCEPT;
  nec_state = NEC_STATE_ACCEPT;
} else {
  nec_data = (nec_data << 1) | 1;
  if (decide_NEC_Jam(nec_data)) {
      irsend.sendNEC(0xFFFFFFFF, 32);
      Serial.println("JAMMMMMMM");            
      nec_data = 0;
      data_bit_counter = 0;
      irJam.start();
      return;
  }
  irparams.rawbuf[offset++] = NEC_STATE_ACCEPT;
  nec_state = NEC_STATE_ACCEPT;
} 
\end{lstlisting}
In our experiments, we experienced that even only jamming the last bit of an IR frame keeps the receiver from getting a valid
command. Furthermore, the time for sending a bit is always at least 1120$\mu$s which is far more than the time needed to detect a filter match and
act according to this decision. Therefore it is possible to hold the jamming decision until the second last bit and still be able to
destroy the transmission at the receiver.